From 90ce2a9c1d3af422c66b4061805831cb208263d8 Mon Sep 17 00:00:00 2001 From: Dan Stoza Date: Mon, 1 May 2017 16:31:53 -0700 Subject: libgui: Check slot received from IGBP in Surface Checks that the slot number received from mGraphicBufferProducer in Surface::dequeueBuffer is on the interval [0, NUM_BUFFER_SLOTS) to protect against a malicious BnGraphicBufferProducer. Bug: 36991414 Change-Id: I1a76fd1bcce1c558f1c0c30f03638278288ed4fa --- libs/gui/Surface.cpp | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'libs/gui/Surface.cpp') diff --git a/libs/gui/Surface.cpp b/libs/gui/Surface.cpp index 0e2baa28fd..667c34a7e7 100644 --- a/libs/gui/Surface.cpp +++ b/libs/gui/Surface.cpp @@ -222,6 +222,12 @@ int Surface::dequeueBuffer(android_native_buffer_t** buffer, int* fenceFd) { return result; } + if (buf < 0 || buf >= NUM_BUFFER_SLOTS) { + ALOGE("dequeueBuffer: IGraphicBufferProducer returned invalid slot number %d", buf); + android_errorWriteLog(0x534e4554, "36991414"); // SafetyNet logging + return FAILED_TRANSACTION; + } + Mutex::Autolock lock(mMutex); sp& gbuf(mSlots[buf].buffer); -- cgit v1.2.3-59-g8ed1b